CVE-2000-0329: Medium severity Microsoft ie vulnerability
A Microsoft ActiveX control allows a remote attacker to execute a malicious cabinet file via an attachment and an embedded script in an HTML mail, aka the "Active Setup Control" vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove the affected component from your environment.
Uninstall, unregister, or disable the 'Active Setup Control' ActiveX control if it is not required.
- Configuration
Disable ActiveX controls and Active Scripting in Internet Explorer (e.g., set security zone to block/disable ActiveX and scripting) to prevent execution of embedded scripts.
Internet Explorer ActiveX / Active Scripting = disabled - Configuration
Configure Microsoft Outlook to not automatically render HTML content or execute scripts in email (display messages as plain text or block embedded scripts) to prevent execution of embedded script in HTML mail.
Microsoft Outlook HTML rendering / script execution in email = display as plain text / block scripts - Configuration
Configure Microsoft Outlook Express to not automatically render HTML content or execute scripts in email (display messages as plain text or block embedded scripts) to prevent execution of embedded script in HTML mail.
Microsoft Outlook Express HTML rendering / script execution in email = display as plain text / block scripts - Compensating control
Block or strip .cab (cabinet) attachments and other executable cabinet files at the mail gateway or perimeter security devices to prevent delivery of malicious cabinet attachments.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0329?
CVE-2000-0329 is categorized as a critical vulnerability that can result in remote code execution.
How do I fix CVE-2000-0329?
To fix CVE-2000-0329, users should apply the security updates provided by Microsoft for the affected software.
Which versions of Microsoft Outlook are affected by CVE-2000-0329?
CVE-2000-0329 affects Microsoft Outlook versions 2000 and 98.
Does CVE-2000-0329 affect older versions of Internet Explorer?
Yes, CVE-2000-0329 affects multiple older versions of Internet Explorer, including 4.0 and 5.0.
Can CVE-2000-0329 be exploited through email?
Yes, CVE-2000-0329 can be exploited via HTML emails that include malicious attachments.